Before
Analysts likely had to review the incoming IOC, identify the related cloud instance, and decide whether the alert required containment. They then had to move between cloud administration, Jira, and team communications to isolate or stop the instance, preserve its volume, document the work, and close or archive the incident.
How it works
- Receive the external IOC or GuardDuty alert, retrieve the associated cloud instance, create the Jira incident, and notify the SOC team.
- Evaluate whether the IOC is actionable and route the incident either to documentation and archival or to the containment path.
- For actionable cases, isolate and stop the instance, remove its key pair, create an EBS snapshot, and record the completed response in Jira.
Workflow details
- Alert intake and investigation: The workflow starts when an external IOC or GuardDuty alert is received, then retrieves the associated EC2 instance information so the alert can be evaluated against a specific cloud resource.
- Incident documentation and notification: It creates a detailed Jira issue for the incident and sends a notification to the SOC team channel, ensuring the response is visible in both the case record and the team communication channel.
- Automated response decision: A response condition determines whether the IOC is actionable. If no isolation is required, the workflow documents the preceding actions in Jira and archives the issue.
- Cloud containment and remediation: When isolation is required, the workflow updates the EC2 instance to attach an isolation configuration, removes its key pair, and stops the instance to contain the affected resource.
- Evidence preservation and closure: The workflow retrieves the instance's EBS volume, creates a snapshot for preservation, adds the remediation history to the Jira issue, and maintains the incident record for follow-up.
What changed
The alert now starts a coordinated response that performs the investigation, routing decision, cloud containment, evidence snapshot, team notification, and Jira documentation automatically. The incident record is updated as the response progresses, reducing the need for analysts to switch between systems and manually sequence the remediation steps.
Work removed
Manually reviewing each alert, looking up the affected EC2 instance, creating and updating the Jira issue, notifying the SOC channel, deciding the response path, applying isolation, deleting the key pair, stopping the instance, locating its EBS volume, creating a snapshot, and archiving the completed issue.
Expected outcome
For each actionable IOC, the workflow can remove at least seven recurring manual response actions from the analyst checklist while consistently producing a documented containment and evidence-preservation record.
